CVE-2026-93018: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Imager versions before 1.036 for Perl leak uninitialised heap memory when reading paletted images that contain pixel indexes at or beyond the image's colour map. The palette is allocated uninitialised and only entries actually populated by the reader count; the TGA reader stores pixel indexes without validating them against the colour map, and the bounds handling in i_gpix_p() (which only rejects indexes greater than the count) and i_glin_p() (which silently skips out-of-range pixels) lets reads at the boundary return the first unpopulated entry, so fetching pixels or converting the image to RGB exposes prior heap contents to the caller. An attacker who can submit a crafted paletted image (e.g., a TGA file) to an application that decodes it via Imager->read() can harvest fragments of process heap memory, potentially including sensitive data held by the host application. Any application, script, or service using the Imager module before 1.036 to process untrusted images is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no CVSS score has been assigned, with no exploitation reported to date.